CVE-2024-1132 Keycloak: path transversal in redirection validation

2024-04-1713:21:19

CWE-22

redhat

github.com

cve-2024-1132

keycloak

url validation

bypass

sensitive information

wildcard

user interaction

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

6.2 Medium

AI Score

Confidence

Low

0.0005 Low

EPSS

Percentile

17.2%

JSON

A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. This issue could allow an attacker to construct a malicious request to bypass validation and access other URLs and sensitive information within the domain or conduct further attacks. This flaw affects any client that utilizes a wildcard in the Valid Redirect URIs field, and requires user interaction within the malicious URL.

CNA Affected

[
  {
    "cpes": [
      "cpe:/a:redhat:migration_toolkit_runtimes:1.0::el8"
    ],
    "vendor": "Red Hat",
    "product": "Migration Toolkit for Runtimes 1 on RHEL 8",
    "versions": [
      {
        "status": "unaffected",
        "version": "1.2-23",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "mtr/mtr-operator-bundle",
    "collectionURL": "https://catalog.redhat.com/software/containers/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:migration_toolkit_runtimes:1.0::el8"
    ],
    "vendor": "Red Hat",
    "product": "Migration Toolkit for Runtimes 1 on RHEL 8",
    "versions": [
      {
        "status": "unaffected",
        "version": "1.2-15",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "mtr/mtr-rhel8-operator",
    "collectionURL": "https://catalog.redhat.com/software/containers/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:migration_toolkit_runtimes:1.0::el8"
    ],
    "vendor": "Red Hat",
    "product": "Migration Toolkit for Runtimes 1 on RHEL 8",
    "versions": [
      {
        "status": "unaffected",
        "version": "1.2-16",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "mtr/mtr-web-container-rhel8",
    "collectionURL": "https://catalog.redhat.com/software/containers/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:migration_toolkit_runtimes:1.0::el8"
    ],
    "vendor": "Red Hat",
    "product": "Migration Toolkit for Runtimes 1 on RHEL 8",
    "versions": [
      {
        "status": "unaffected",
        "version": "1.2-14",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "mtr/mtr-web-executor-container-rhel8",
    "collectionURL": "https://catalog.redhat.com/software/containers/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:migration_toolkit_applications:6.2::el9",
      "cpe:/a:redhat:migration_toolkit_applications:6.2::el8"
    ],
    "vendor": "Red Hat",
    "product": "MTA-6.2-RHEL-9",
    "versions": [
      {
        "status": "unaffected",
        "version": "6.2.3-2",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "mta/mta-windup-addon-rhel9",
    "collectionURL": "https://catalog.redhat.com/software/containers/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:build_keycloak:22::el9"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat build of Keycloak 22",
    "versions": [
      {
        "status": "unaffected",
        "version": "22.0.10-1",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "rhbk/keycloak-operator-bundle",
    "collectionURL": "https://catalog.redhat.com/software/containers/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:build_keycloak:22::el9"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat build of Keycloak 22",
    "versions": [
      {
        "status": "unaffected",
        "version": "22-13",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "rhbk/keycloak-rhel9",
    "collectionURL": "https://catalog.redhat.com/software/containers/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:build_keycloak:22::el9"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat build of Keycloak 22",
    "versions": [
      {
        "status": "unaffected",
        "version": "22-16",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "rhbk/keycloak-rhel9-operator",
    "collectionURL": "https://catalog.redhat.com/software/containers/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:build_keycloak:22"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat build of Keycloak 22.0.10",
    "packageName": "keycloak",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:amq_broker:7.10"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat JBoss A-MQ 7",
    "packageName": "keycloak",
    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:amq_broker:7.11"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat JBoss A-MQ 7",
    "packageName": "keycloak",
    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:amq_broker:7.12"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat JBoss A-MQ 7",
    "packageName": "keycloak",
    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:red_hat_single_sign_on:7.6::el7"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Single Sign-On 7.6 for RHEL 7",
    "versions": [
      {
        "status": "unaffected",
        "version": "0:18.0.13-1.redhat_00001.1.el7sso",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "rh-sso7-keycloak",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:red_hat_single_sign_on:7.6::el8"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Single Sign-On 7.6 for RHEL 8",
    "versions": [
      {
        "status": "unaffected",
        "version": "0:18.0.13-1.redhat_00001.1.el8sso",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "rh-sso7-keycloak",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:red_hat_single_sign_on:7.6::el9"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Single Sign-On 7.6 for RHEL 9",
    "versions": [
      {
        "status": "unaffected",
        "version": "0:18.0.13-1.redhat_00001.1.el9sso",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "rh-sso7-keycloak",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:rhosemc:1.0::el8"
    ],
    "vendor": "Red Hat",
    "product": "RHEL-8 based Middleware Containers",
    "versions": [
      {
        "status": "unaffected",
        "version": "7.6-46",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "rh-sso-7/sso76-openshift-rhel8",
    "collectionURL": "https://catalog.redhat.com/software/containers/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:red_hat_single_sign_on:7.6"
    ],
    "vendor": "Red Hat",
    "product": "RHSSO 7.6.8",
    "packageName": "keycloak",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:quarkus:3"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat build of Quarkus",
    "packageName": "org.keycloak/keycloak-core",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:jboss_data_grid:8"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Data Grid 8",
    "packageName": "org.wildfly.security-wildfly-elytron-parent",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:jboss_enterprise_brms_platform:7"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Decision Manager 7",
    "packageName": "keycloak",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unknown"
  },
  {
    "cpes": [
      "cpe:/a:redhat:service_registry:2"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Integration Service Registry",
    "packageName": "keycloak",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:jboss_data_grid:7"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Data Grid 7",
    "packageName": "keycloak",
    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:jboss_enterprise_application_platform:6"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Enterprise Application Platform 6",
    "packageName": "keycloak",
    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
    "defaultStatus": "unknown"
  },
  {
    "cpes": [
      "cpe:/a:redhat:jboss_enterprise_application_platform:7"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Enterprise Application Platform 7",
    "packageName": "keycloak",
    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:jboss_fuse:7"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Fuse 7",
    "packageName": "keycloak",
    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:jboss_enterprise_bpms_platform:7"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Process Automation 7",
    "packageName": "keycloak",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  }
]